CISA added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on August 18, 2026, all confirmed under active attack, three of them rated CVSS 9.8. The batch spans four different vendors: Microsoft Windows, Microsoft SharePoint, VMware vCenter, and Apple macOS. Federal civilian agencies had until August 21 to patch or disconnect the affected systems. That deadline has already passed, and security teams outside government are still racing to catch up.
What makes this KEV batch unusual isn’t just the severity score. It’s the speed. One of the four flaws, a SharePoint authentication bypass, went from public technical writeup to confirmed exploitation in a matter of hours. Another, the VMware vCenter path traversal bug, spread to 361 compromised servers across 47 countries within nine days of the patch shipping. For any team still running a monthly or quarterly patch cycle, this week’s CISA KEV catalog update is the clearest signal yet that the old cadence no longer works.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What CISA Added to the KEV Catalog on August 18
CISA’s Known Exploited Vulnerabilities catalog exists to separate theoretical risk from confirmed, real-world attacks. A CVE only lands on the list once CISA has evidence that someone, somewhere, is already exploiting it. Getting four listed in a single week, all above CVSS 9.0, is a rare occurrence even by 2026 standards. Here’s the full lineup CISA published on August 18.
| CVE | Product | CVSS | Flaw Type | Authentication Required |
|---|---|---|---|---|
| CVE-2026-33824 | Windows IKE Service Extensions | 9.8 | Double-free memory corruption, wormable RCE | No |
| CVE-2026-55040 | SharePoint (on-premises) | 9.1 | JWT authentication bypass | No |
| CVE-2026-59310 | VMware vCenter Syslog Server | 9.8 | Unauthenticated path traversal to RCE | No |
| CVE-2026-65400 | macOS Screen Sharing | 9.8 | Authentication bypass, root access | No |
Three of the four require zero authentication. An attacker doesn’t need stolen credentials, a phished password, or an insider foothold. Network reachability alone is enough. That’s the throughline connecting a Windows VPN service, an enterprise content management platform, a virtualization console, and a consumer operating system feature that, on paper, have nothing to do with each other.
CVE-2026-33824: The Windows IKE Flaw Patched Since April
CVE-2026-33824 is a double-free bug in how Windows reassembles IKEv2 packets, the protocol underpinning VPN key exchange. An attacker sends specially crafted UDP packets to port 500 or 4500, no login required, and triggers memory corruption that can lead to remote code execution. Because exploitation needs nothing but network reachability, researchers have flagged it as wormable, capable of spreading server to server without human interaction.
Microsoft shipped the fix back in its April 2026 update cycle. The fact that CISA is only now confirming active exploitation four months later says less about the flaw and more about patch backlog: a meaningful share of internet-facing Windows systems still haven’t applied a fix that’s been public for months.
CVE-2026-55040: SharePoint’s JWT Bypass and a Decade-Old Mistake
CVE-2026-55040 is a textbook case of an old vulnerability class resurfacing in new code. SharePoint’s on-premises token validation accepted JSON Web Tokens signed with alg: none, a bypass technique documented for more than a decade and formally deprecated by the IETF back in 2020. An attacker forges a token referencing SharePoint’s own certificate, and the server accepts it without ever checking the signature, granting access as a regular user or, in some cases, a full administrator.
Microsoft patched the on-premises flaw in July 2026. It does not affect SharePoint Online inside Microsoft 365, so cloud-only tenants are not exposed to this specific bug. Rapid7 published a technical breakdown of the flaw on August 11, and within hours, security teams observed active exploitation against unpatched on-premises servers. Researchers tracking Microsoft’s disclosures note this is the fifth distinct SharePoint vulnerability actively exploited in 2026 alone, following a string of on-premises SharePoint incidents earlier in the year.
CVE-2026-59310: VMware vCenter’s Path Traversal Bug Hits 47 Countries
Broadcom disclosed CVE-2026-59310, a directory traversal flaw in vCenter Server’s Syslog component, on July 29. Five days later, on August 3, security researchers observed a suspected advanced persistent threat actor already exploiting it in the wild. By August 7, incident responders had tracked 361 compromised IP addresses spread across 47 countries, with the heaviest concentrations in Germany, the United States, Turkey, Iran, and France. Post-exploitation, attackers have been deploying the open-source reverse_ssh framework to establish persistent, firewall-evading command and control on compromised appliances. Roughly 95% of identified victims were compromised within the first 48 hours of active exploitation starting, according to incident response data cited by security researchers tracking the campaign.
Broadcom has confirmed there is no workaround for this flaw, only the patch. Anyone running vCenter 8.0, 9.0, or 9.1 without the fix applied should treat the system as compromised until proven otherwise, not merely at risk. Read our full breakdown of the incident in VMware vCenter Zero-Day Hits 47 Countries: CVSS 9.8.
CVE-2026-65400: macOS Screen Sharing and the Cryptomining Campaign
CVE-2026-65400 is an authentication flaw in macOS’s built-in Screen Sharing feature, caused by insufficient session-state management. It lets an attacker on the network connect to a Mac’s Screen Sharing service, typically reachable over port 5900, without a valid password. Apple patched the flaw on August 6 across macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9.
The Dutch National Cyber Security Centre has since documented real-world exploitation, reporting that attackers gained root access on internet-exposed Macs and used that access to install Monero cryptocurrency miners. Root access handed to a cryptominer operator today is root access that could just as easily be handed to a ransomware crew or data thief tomorrow. The most highly exposed systems are Macs with Screen Sharing reachable directly from the internet, commonly through a router port-forward or a self-hosted remote access setup, though systems exposed only on an internal network remain at risk once an attacker has any foothold.
The Shrinking Patch-to-Exploit Window
Line up the timelines for all four CVEs and a pattern emerges that should worry any organization still running quarterly patch reviews.
| CVE | Patch or Disclosure Date | First Confirmed Exploitation | Time to Exploit |
|---|---|---|---|
| CVE-2026-33824 (Windows IKE) | April 2026 | Confirmed by CISA, August 2026 | ~4 months (patch backlog) |
| CVE-2026-55040 (SharePoint) | Patched July 2026; PoC published Aug 11 | Within hours of Aug 11 writeup | Hours |
| CVE-2026-59310 (vCenter) | Disclosed July 29, 2026 | August 3, 2026 | 5 days |
| CVE-2026-65400 (macOS) | Patched August 6, 2026 | Confirmed active shortly after by Dutch NCSC | Days |
The SharePoint case is the starkest: a technical writeup from Rapid7 turned into live exploitation within hours. The vCenter case shows how fast a single flaw can scale, from first exploitation to 361 confirmed victims across 47 countries in under two weeks. Neither timeline leaves room for a one-to-three-week patch-testing cycle, which is still the norm at a lot of mid-size organizations and managed service providers.
Federal Deadlines vs. Everyone Else
CISA’s KEV remediation deadlines are legally binding only for federal civilian executive branch agencies. Private companies, schools, hospitals, and state and local governments are under no legal obligation to hit the same August 21 deadline. But the vCenter campaign’s 361 compromised servers make clear that attackers are not checking whether a target is a regulated federal system before they scan. Treating the KEV list as an urgent internal deadline, not a government-only checkbox, is the practical takeaway security teams are drawing from this batch.
AI-Powered Reconnaissance Raises the Stakes
Alongside the four CVEs, Palo Alto Networks’ Unit 42 threat intelligence team published research documenting what it describes as the first large-scale example of a threat actor wiring a commercial AI language model into an open-source attack framework to autonomously scout targets. In one recovered session, the operator issued a single high-level instruction. Everything after that, surveying target categories, searching for trending public exploits, evaluating which vulnerability would affect the largest number of internet-facing systems, and identifying more than 647,000 potential targets, happened without further human input.
The autonomous session itself did not result in a confirmed breach. The group’s actual compromises reportedly still came from more conventional, manual exploitation. But the capability is now documented, functional, and built entirely from publicly available tools. Unit 42’s conclusion is blunt: autonomous AI-driven reconnaissance is operationally viable today, not a future risk. That lowers the bar for who can run a wide-scale scanning operation, and it means an unpatched, internet-facing server no longer needs to look interesting to a human attacker to get swept up in an automated net that used to take days and now takes minutes.
Market Impact: Vendors, MSSPs, and the Cost of Delay
For Broadcom, Microsoft, and Apple, the immediate cost is support load and reputational friction rather than a stock-moving event; all three vendors had patches available before CISA’s KEV listing went live. The bigger commercial ripple is on the buyer side. Managed security service providers are using this exact batch as a sales pitch for continuous vulnerability scanning over quarterly penetration testing, arguing that a five-day exploitation window makes point-in-time testing close to useless. Cyber insurers, meanwhile, are increasingly asking underwriting questions tied directly to KEV compliance: whether an applicant patches KEV-listed flaws within days, not the applicant’s general patch policy.
Where the Financial Exposure Concentrates
Virtualization infrastructure carries the highest concentration risk of the four. A single compromised vCenter appliance can expose every virtual machine it manages, which is why the 361-server vCenter tally is the figure security teams are watching most closely. SharePoint and Windows IKE exposure scales with how many internet-facing instances an organization runs, while the macOS flaw is a longer tail risk concentrated in creative agencies, professional offices, and small practices where Macs are common and centralized patch management is often thinner.
Historical Context: How KEV Became Mandatory Reading
CISA launched the Known Exploited Vulnerabilities catalog in November 2021 under Binding Operational Directive 22-01, initially as a compliance tool aimed narrowly at federal civilian agencies. Over the following five years, it evolved into something closer to an industry-wide early warning system, referenced by insurers, auditors, and security vendors well outside government. The catalog has grown from roughly 300 entries at launch to well over a thousand today, and additions like this month’s four-CVE batch have become a recurring rhythm rather than a rare event. What’s changed most since the catalog’s early years isn’t the volume of listings, it’s the shrinking gap between a CVE’s public disclosure and its appearance on the list, a trend directly tied to faster proof-of-concept development and, more recently, automated exploit tooling.
CISA KEV vs Other Vulnerability Databases
Security teams juggle several overlapping vulnerability sources, and it’s worth being clear about what each one actually tells you.
- CISA KEV catalog: Lists only vulnerabilities with confirmed real-world exploitation. It is the narrowest but most action-oriented list, and the one carrying binding federal deadlines.
- NVD (National Vulnerability Database): Catalogs essentially every published CVE with a CVSS score, regardless of whether exploitation has ever been observed. Useful for scoring, not for prioritization on its own.
- MITRE CVE list: The underlying identifier registry that both NVD and KEV draw from; it assigns and tracks CVE numbers but doesn’t itself assess exploitation status.
- Vendor advisories (Broadcom, Microsoft Security Response Center, Apple security updates): The first and most authoritative source for patch availability and affected version ranges, but they rarely confirm active exploitation as quickly as CISA does.
The practical lesson from this month’s batch: a high CVSS score alone doesn’t tell you to drop everything. A KEV listing does. All four of this week’s CVEs carried high CVSS scores for weeks or months before KEV confirmed active exploitation, and in at least two cases, organizations that patched on CVSS severity alone were still ahead of organizations that waited for a KEV listing to act.
Detection and Mitigation Steps for IT Teams
The immediate action list is short and specific to each product:
- Patch all four vulnerabilities immediately if you run Windows, on-premises SharePoint, VMware vCenter, or macOS with Screen Sharing enabled.
- If vCenter or SharePoint can’t be patched today, restrict network access to trusted management IPs only as a stopgap, not a permanent fix.
- Disable Screen Sharing on any internet-exposed Mac until the August 6 update is confirmed installed.
- Check firewall and network logs for
reverse_sshtraffic if you run vCenter — that’s the documented persistence signature for this campaign. - Treat “patched” and “clean” as two separate facts. A server patched today may have already been compromised before the fix was applied; check for unfamiliar accounts, unexpected processes, and unusual outbound connections.
Checking for the vCenter Persistence Signature
Security teams reviewing firewall logs for signs of the vCenter campaign’s command-and-control channel can start with a simple traffic pattern check for outbound SSH-like connections initiated from the vCenter appliance itself, which shouldn’t normally originate outbound SSH sessions to unfamiliar external hosts:
// Example log grep for suspicious outbound SSH from a vCenter host
grep -E "vcenter-host.*:22 ->" /var/log/firewall.log | \
awk '{print $NF}' | sort | uniq -c | sort -rn | head -20
// Cross-reference any unfamiliar destination IPs against known vCenter
// management ranges. Outbound connections to unrecognized hosts on
// port 22 from an appliance that should only receive inbound traffic
// are the reverse_ssh persistence signature documented in this campaign.This is not a substitute for a full incident response engagement if compromise is confirmed, but it’s a fast first check that doesn’t require new tooling.
What Comes Next: 5 Predictions
- More multi-vendor KEV batches, not fewer. Four unrelated products landing on the list together in one week is likely to become a recurring pattern rather than a one-off, as CISA’s confirmation pipeline speeds up alongside faster exploitation.
- SharePoint’s exploitation streak continues. With five actively exploited SharePoint CVEs already confirmed in 2026, on-premises SharePoint deployments will keep drawing attacker attention through the rest of the year, particularly at organizations that haven’t migrated to SharePoint Online.
- Cyber insurers tighten KEV-specific patch clauses. Expect more policies to explicitly require KEV-listed patches within a fixed window (days, not weeks) as a condition of coverage, following the direction insurers were already moving before this batch.
- AI-assisted reconnaissance tools spread beyond one threat actor. Unit 42’s documented case is unlikely to stay isolated; the underlying technique uses only publicly available components, meaning other groups can replicate it without custom development.
- Virtualization infrastructure remains the highest-value target class. Given the blast radius of a single compromised vCenter host, expect continued attacker focus on hypervisor and management-plane software over the next several KEV cycles.
Related Coverage
- VMware vCenter Zero-Day Hits 47 Countries: CVSS 9.8 [2026]
- Cisco ASA/FTD Zero-Day: CVSS 8.6, No Workaround [2026]
- Windows Zero-Day Hits Patch Tuesday: 421 CVEs Fixed [2026]
- Microsoft Defender ShieldBreak Zero-Day: 100% Bypass [2026]
- Vulnerability Management Program: 12 Steps, 100 Min [2026]
- How to Protect Against Ransomware: 13 Steps, 100 Min [2026]
For broader tracking of the vulnerabilities, exploits, and breaches shaping this year, see our cybersecurity threats 2026 hub.
Frequently Asked Questions
What is the CISA KEV catalog?
It’s a running list CISA maintains of vulnerabilities with confirmed real-world exploitation, not just theoretical risk. Federal civilian agencies are legally required to patch KEV-listed flaws by CISA’s stated deadline; everyone else should treat a KEV listing as a priority signal, since these are the bugs attackers are actually using right now.
Do I need to worry about these four vulnerabilities if I’m not a federal agency?
Yes. CISA’s remediation deadlines bind only federal agencies, but the vulnerabilities are being exploited against everyone, as the vCenter campaign’s 361 compromised servers across 47 countries makes clear. Attackers don’t check who’s regulated before they scan a network range.
Does the SharePoint flaw affect Microsoft 365 / SharePoint Online?
No. CVE-2026-55040 affects on-premises SharePoint Server deployments only. Organizations running fully cloud-based SharePoint Online through Microsoft 365 are not exposed to this specific vulnerability.
Is there a workaround for the VMware vCenter flaw if I can’t patch immediately?
Broadcom has confirmed there is no workaround, only the patch. As a temporary stopgap, restrict network access to the vCenter management interface to trusted IPs only, and monitor for the reverse_ssh persistence signature described above while you schedule the update.
How fast should I expect a patch to become a live exploit going forward?
Increasingly, in hours to days, not weeks. The SharePoint flaw was exploited within hours of a public technical writeup; the vCenter flaw within five days of the patch’s release. Security teams are being urged to build patch cadences around that reality rather than the older assumption of a comfortable multi-week window.
What macOS versions fix the Screen Sharing vulnerability?
Apple’s August 6, 2026 security update patches CVE-2026-65400 across macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. Systems on older, unsupported macOS versions remain exposed regardless of settings changes.
What is the AI-driven reconnaissance Unit 42 documented?
Palo Alto Networks’ Unit 42 documented a threat actor connecting a commercial AI language model to an open-source attack framework to autonomously identify more than 647,000 potential targets from a single high-level instruction. The session itself didn’t produce a confirmed breach, but it demonstrates that automated, AI-assisted target scouting is now operationally viable rather than theoretical.
Where can I check the official CVE record for these vulnerabilities?
Each CVE has a public record on the CVE.org registry and the National Vulnerability Database, both of which link back to the relevant vendor advisory for patch details.
